Executive brief
A vulnerability in the Linux kernel's Shared Memory Communications (SMC) protocol could allow a remote attacker to crash the system. By sending a specially crafted network response during the connection setup process, an attacker can trigger a null pointer dereference. This results in a kernel panic (system crash), impacting the availability of the affected server.
Technical details
A null pointer dereference exists in the net/smc/af_smc.c component of the Linux kernel. The root cause is in smc_v2_determine_accepted_chid(), which fails to verify if an ISM device is actually present (non-NULL) before matching a peer's Channel ID (CHID). A malicious peer can respond to an SMC-Dv2-only proposal with a CHID of 0, which matches an uninitialized (NULL) slot in the client's device array. This leads to a null pointer dereference when the kernel later attempts to access the device's lock in smc_conn_create(). The vulnerability is reachable over the network without authentication. Patches have been released for various stable kernel branches including 5.10, 5.15, 6.1, and 6.6.
Affected products
- Linux Linux Kernel 5.10 to 6.9.x
Timeline
- 2026-05-10: other: Vulnerability fixed in main development tree
- 2026-07-19: advisory: CVE-2026-64048 published
References
- https://git.kernel.org/stable/c/277740023def559a4a2ddc3e8e784ee37a0f16a9
- https://git.kernel.org/stable/c/53eb7bd09aace72fa17510d80e0caf5ca058c231
- https://git.kernel.org/stable/c/65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e
- https://git.kernel.org/stable/c/6927cacf2b10d4fa80c1a2d407512ef9397c59c6
- https://git.kernel.org/stable/c/afa9036b8c9963947b487c36e332df6a42c96fcb
- https://git.kernel.org/stable/c/d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0